Written by:

Nataliia Pinchuk, Advisor at State Service for Special Communications and Informational Protection of Ukraine (SSSCIP)


There is a war going on in Ukraine. An exhausting bloody war with thousands of casualties and tens of thousands of civilian victims, including 361 children murdered by Russian troops. Military actions are being conducted not only on land, in the air and at sea. This is also the very first cyberwar in the world’s history.

And we, the SSSCIP, as an agency in charge of cyber defense, government communications and operation of digital communication networks during wartime, are at the forefront of Ukraine’s defense in cyberspace.

A global transformation of the SSSCIP started about a year prior to the invasion. The Service started to transform from a totally closed military structure into a transparent public agency. It has become necessary because of the new challenges that Ukraine is currently faced with. The warfare in cyberspace has begun simultaneously with the military invasion of Ukrainian lands. The importance of cybersecurity for the country’s survival has expanded drastically, as Russian hackers have been using different methods every time to attack our information systems, often combining them with propaganda and disinformation in the media. Similarly, the role of Ukraine in the international arena in the context of cyber defense has increased as well, since our experience as a forefront country is invaluable for the entire democratic world that is suffering from Russian cyberattacks.

There is no way for someone to know about your misfortune and come to the rescue if you keep silent about it. So, in order to resist the national-level challenges more efficiently, we had to overcome the domestic challenge, i.e. the wall of silence and misperception. It means we had to ensure a sufficient level of communication not to only inform of our activities, but also to deliver the message about our needs.

In fact, the SSSCIP communications have been built from ground zero over the last 18 months. Plus, one-third of this period falls on wartime. After all, what one may call a full-scale invasion in cyberspace started in January 2022, over a month prior to Russia’s military invasion of Ukraine.

Back in 2021, only a handful of people both in Ukraine and abroad (except those directly involved) knew about our agency and its activity, awareness of cyber threats among the people was minimal, as was the interest in us and our tasks among Ukrainian media, let alone international ones.

Starting January 1, 2022, the top management of the SSSCIP has given hundreds of interviews. Hundreds of thousands of people have subscribed to our social media in Ukrainian. Around 150 thousand users are reading and sharing our recommendations on the safe use of technologies in Telegram. Our Twitter account is followed by all the world’s top journalists covering telecom and cybersecurity.

Most of these results have been achieved within three-plus months of the war. How is it possible?

Transparency is a major factor

Cyberattacks waged by Russian hackers against Ukraine at the beginning of the year aimed at threatening people, spreading panic, havoc and distrust of the authorities. There was a huge demand among people, both in Ukraine and abroad, for accurate information about what was going on and the actual extent of the threat.

 The SSSCIP management came up with communication and answers to the questions about what had happened as expeditiously as possible. People value and appreciate the sincerity. These are not just some loud words, but the foundation for building up trust.

 Another factor is being focused on the audience’s needs

 There has been next to no demand for content on cyber defense, cyber hygiene, etc. in our society until recently. It has grown as russian aggression against Ukraine escalated.

 Today, security is a primary concern for Ukrainians. So, all our actions are to ensure it as quickly and completely as possible.

This includes prompt restoration of telecommunication networks after assaults and rerouting Internet traffic in the areas under occupation back to Ukrainian networks, given a chance. This also includes cyber defense, as our experts are always there to respond and assist in case of an enemy attack.

This also includes the content. As a defense agency in the cybersecurity sector, our purpose is to defend. As such, our objectives include training Ukrainians to defend themselves in cyberspace. And we are doing that in the form most comfortable to them.

Many of our readers are not in safety, some have very limited access to the Internet or even power supply, some of them live in occupied territories and cannot connect to Ukrainian internet service providers. So, all the recommendations we present are being delivered in a format technically usable by respective audiences. Not only are we adapting our content to communication channels, but we also are taking content consumers’ technical and infrastructure aspects into account.

The third factor is international resonance

It would be hard to find even a single civilized country in the whole world that has not been targeted by Russian hackers at least once.

The world has had enough of all these covert assaults, fancied by the Russian government, and there is a great demand for dealing with this.

Ukraine is ready to share its experience and is actively participating in international cybersecurity events. We also share information, which can be useful to our partners, on a regular basis.

We conduct media briefings and prepare analytics as a monthly digest shared among our subscribers in professional communities, i.e. information security experts, public officials, mass media, etc.

And we are receiving proper feedback. Ukraine’s partners and friends help us with technological solutions and innovations, which help us strengthen our cyber resilience and oppose the enemy.

Ukraine has travelled a difficult road of learning by doing, so now we know how cyberattacks are connected to other manifestations of enemy aggression, such as conventional warfare and PsyOps.

This is why we have been following several key principles to build quality Digital Diplomacy & Digital Communication for the SSSCIP in a very short time during the active phase of the war:

  • Maximum expeditiousness and sometimes acting ahead of the planned enemy propaganda. This requires 24/7 collaboration with other public institutions and systematic exchange of information.
  • Communication transparency and comprehensive information delivery along with maximum use of integrated communications, not only our own media services but also those of other institutions, TV, WOM, influencers, printed and online media outlets, and digital ads.
  • Maximum engagement and management of available resources — there is no such thing as too much communication when dealing with such issues. This is why we used to engage the maximum available resources of the international community, volunteers, students, specialists, businesses, and civil society organizations. Each had its own separate information access area, their own tasks and processing system, while the key priority was maximized planning of efficient use of these resources.
  • Close partnership with the international community, based on common values: building strong relationships with a number of countries is based not just on benefits for each party, but also on key social principles upheld by the country or business institution in question. An alliance around democratic values, protection of human life, rights and freedoms is the best motivation for productive cooperation.

 The world’s first cyber war has only started and the communication area is one of its major aspects. While national governments are developing cyber deterrence and response procedures, each communication team should consider how to utilize these aspects, including the diplomatic front. It is not always possible to prove any involvement of a country in a cyberattack simply by technical attribution. But it may be done through communication when there is an obvious linkage between cyberattacks and information propaganda aimed at inciting squabbles between countries.